Plone is vulnerable to information exposure via the object manager implementation

2022-05-1704:49:45

Google

osv.dev

plone

object manager

vulnerability

information exposure

remote attackers

sensitive information

crafted request

EPSS

0.003

Percentile

71.2%

JSON

The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.